@article{LARA2024101427,

title = {Anomaly-based Intrusion Detection System for smart lighting},

author = {Agustín Lara and Antonio Estepa and Rafael Estepa and Jesús E. Díaz-Verdejo and Vicente Mayor},

url = {https://www.sciencedirect.com/science/article/pii/S2542660524003688},

doi = {https://doi.org/10.1016/j.iot.2024.101427},

issn = {2542-6605},

year  = {2024},

date = {2024-01-01},

urldate = {2024-01-01},

journal = {Internet of Things},

volume = {28},

pages = {101427},

abstract = {Smart Lighting Systems (SLS) are essential to smart cities, offering enhanced energy efficiency and public safety. However, they are susceptible to security threats, potentially leading to safety risks and service disruptions, making the protection of this infrastructure critical. This paper presents an anomaly-based Intrusion Detection System (IDS) designed for a real-world operational SLS. As commercial deployments vary in components, protocols, and functionalities, IDSs must be tailored to the specific characteristics of each deployment to perform effectively. Our anomaly-based IDS has been defined based on the properties of the available data and the types of attacks we aim to detect, offering both explainability and low complexity. The proposed system identifies anomalies in seven features of network traffic and in the telemetry data received at the central control (O&M) server. For the latter, we designed three customized detectors to identify abnormal data points, persistent deviations in street lamp power consumption, and abnormal power value based on the time of day. Validation with real-world data and simulated attacks demonstrates the effectiveness of our approach. Network attacks (e.g., DoS, scanning) were detected by at least one of the seven flow-related anomaly detectors, while simulated data poisoning attacks and operational technology (OT) issues were detected with nearly 90% accuracy. The datasets used in this work are publicly available and may serve as reference for the design of future IDSs. While our detectors were designed specifically for our dataset, the variables examined and vulnerabilities addressed are common in most commercial SLSs.},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{Lara2023,

title = {Smart home anomaly-based IDS: Architecture proposal and case study},

author = { {Walabonso Lara}, Agustín and Vicente Mayor and {Estepa Alonso}, Rafael and {Estepa Alonso} , Antonio and Jesús E. {Díaz-Verdejo}},

url = {https://linkinghub.elsevier.com/retrieve/pii/S2542660523000963},

doi = {10.1016/J.IOT.2023.100773},

issn = {2542-6605},

year  = {2023},

date = {2023-07-01},

urldate = {2023-07-01},

journal = {Internet of Things},

volume = {22},

pages = {100773},

publisher = {Elsevier},

abstract = {The complexity and diversity of the technologies involved in the Internet of Things (IoT) challenge the generalization of security solutions based on anomaly detection, which should fit the particularities of each context and deployment and allow for performance comparison. In this work, we provide a flexible architecture based on building blocks suited for detecting anomalies in the network traffic and the application-layer data exchanged by IoT devices in the context of Smart Home. Following this architecture, we have defined a particular Intrusion Detector System (IDS) for a case study that uses a public dataset with the electrical consumption of 21 home devices over one year. In particular, we have defined ten Indicators of Compromise (IoC) to detect network attacks and two anomaly detectors to detect false command or data injection attacks. We have also included a signature-based IDS (Snort) to extend the detection range to known attacks. We have reproduced eight network attacks (e.g., DoS, scanning) and four False Command or Data Injection attacks to test our IDS performance. The results show that all attacks were successfully detected by our IoCs and anomaly detectors with a false positive rate lower than 0.3%. Signature detection was able to detect only 4 out of 12 attacks. Our architecture and the IDS developed can be a reference for developing future IDS suited to different contexts or use cases. Given that we use a public dataset, our contribution can also serve as a baseline for comparison with new techniques that improve detection performance.},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{10036374,

title = {Blockchain-Based Service-Oriented Architecture for Consent Management, Access Control, and Auditing},

author = {Isabel Román-Martínez and Jorge Calvillo-Arbizu and Vicente J. Mayor-Gallego and Germán Madinabeitia-Luque and Antonio J. Estepa-Alonso and Rafael M. Estepa-Alonso},

doi = {10.1109/ACCESS.2023.3242605},

issn = {2169-3536},

year  = {2023},

date = {2023-01-01},

urldate = {2023-01-01},

journal = {IEEE Access},

volume = {11},

pages = {12727-12741},

abstract = {Continuity of care requires the exchange of health information among organizations and care teams. The EU General Data Protection Regulation (GDPR) establishes that subject of care should give explicit consent to the treatment of her personal data, and organizations must obey the individual’s will. Nevertheless, few solutions focus on guaranteeing the proper execution of consents. We propose a service-oriented architecture, backed by blockchain technology, that enables: (1) tamper-proof and immutable storage of subject of care consents; (2) a fine-grained access control for protecting health data according to consents; and (3) auditing tasks for supervisory authorities (or subjects of care themselves) to assess that healthcare organizations comply with GDPR and granted consents. Standards for health information exchange and access control are adopted to guarantee interoperability. Access control events and the subject of care consents are maintained on a blockchain, providing a trusted collaboration between organizations, supervisory authorities, and individuals. A prototype of the architecture has been implemented as a proof of concept to evaluate the performance of critical components. The application of subject of care consent to control the treatment of personal health data in federated and distributed environments is a pressing concern. The experimental results show that blockchain can effectively support sharing consent and audit events among healthcare organizations, supervisory authorities, and individuals.},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{Mayor2023284,

title = {CO-CAC: A new approach to Call Admission Control for VoIP in 5G/WiFi UAV-based relay networks},

author = {V. Mayor and R. Estepa and A. Estepa},

url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-85145556975&doi=10.1016%2fj.comcom.2022.11.006&partnerID=40&md5=8185edfcb26bb2d34ddc5fbccf38f0cb},

doi = {10.1016/j.comcom.2022.11.006},

issn = {01403664},

year  = {2023},

date = {2023-01-01},

urldate = {2023-01-01},

journal = {Computer Communications},

volume = {197},

pages = {284-293},

publisher = {Elsevier B.V.},

abstract = {Voice over IP (VoIP) requires a Call Admission Control (CAC) mechanism in WiFi networks to preserve VoIP packet flows from excessive network delay or packet loss. Ideally, this mechanism should be integrated with the operational scenario, guarantee the quality of service of active calls, and maximize the number of concurrent calls. This paper presents a novel CAC scheme for VoIP in the context of a WiFi access network deployed with Unmanned Aerial Vehicles (UAVs) that relay to a backhaul 5G network. Our system, named Codec-Optimization CAC (CO-CAC), is integrated into each drone. It intercepts VoIP call control messages and decides on the admission of every new call based on a prediction of the WiFi network's congestion level and the minimum quality of service desired for VoIP calls. To maximize the number of concurrent calls, CO-CAC proactively optimizes the codec settings of active calls by exchanging signaling with VoIP users. We have simulated CO-CAC in a 50m × 50m scenario with four UAVs providing VoIP service to up to 200 ground users with IEEE 802.11ac WiFi terminals. Our results show that without CAC, the number of calls that did not meet a minimum quality level during the simulation was 10% and 90%, for 50 and 200 users, respectively. However, when CO-CAC was in place, all calls achieved minimum quality for up to 90 users without rejecting any call. For 200 users, only 25% of call attempts were rejected by the admission control scheme. These results were narrowly worse when the ground users moved randomly in the scenario. © 2022 Elsevier B.V.},

note = {cited By 0},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{Mayor202294,

title = {Deployment of UAV-mounted Access Points for VoWiFi Service with guaranteed QoS},

author = {V. Mayor and R. Estepa and A. Estepa and G. Madinabeitia},

url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-85133540825&doi=10.1016%2fj.comcom.2022.06.037&partnerID=40&md5=e2d77e953e2987abaffb06aca60418c5},

doi = {10.1016/j.comcom.2022.06.037},

issn = {01403664},

year  = {2022},

date = {2022-01-01},

urldate = {2022-01-01},

journal = {Computer Communications},

volume = {193},

pages = {94-108},

publisher = {Elsevier B.V.},

abstract = {Unmanned Aerial Vehicle (UAV) networks have emerged as a promising means to provide wireless coverage in open geographical areas. Nevertheless, in wireless networks such as WiFi, signal coverage alone is insufficient to guarantee that network performance meets the quality of service (QoS) requirements of real-time communication services, as it also depends on the traffic load produced by ground users sharing the medium access. We formulate a new problem for UAVs optimal deployment in which the QoS level is guaranteed for real-time voice over WiFi (VoWiFi) communications. More specifically, our goal is to dispatch the minimum number of UAVs possible to provide VoWiFi service to a set of ground users subject to coverage, call-blocking probability, and QoS constraints. Optimal solutions are found using well-known heuristics that include K-means clusterization and genetic algorithms. Via numerical results, we show that the WiFi standard revision (e.g. IEEE 802.11a/b/g/n/ac) in use plays an important role in both coverage and QoS performance and hence, in the number of UAVs required to provide the service. © 2022 The Author(s)},

note = {cited By 0},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{Mayor2022,

title = {QoS-Aware Multilayer UAV Deployment to Provide VoWiFi Service over 5G Networks},

author = {V. Mayor and R. Estepa and A. Estepa},

url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-85124381535&doi=10.1155%2f2022%2f3110572&partnerID=40&md5=c2fb1ebc948f2679dedab29b078cd4e1},

doi = {10.1155/2022/3110572},

issn = {15308669},

year  = {2022},

date = {2022-01-01},

urldate = {2022-01-01},

journal = {Wireless Communications and Mobile Computing},

volume = {2022},

publisher = {Hindawi Limited},

abstract = {Drones equipped with wireless network cards can provide communication services in open areas. This paper proposes a hierarchical two-layered network architecture with two types of drones according to their communication equipment: Access and Distribution. While access drones provide WiFi access to ground users, distribution drones act as WiFi-to-5G relay forwarding packets into the 5G Core Network. In this context, we formulate a novel optimization problem for the 3-D initial placement of drones to provide Voice over WiFi (VoWiFi) service to ground users. Our optimization problem finds the minimum number of drones (and their type and location) to be deployed constrained to coverage and minimum voice speech quality. We have used a well-known metaheuristic algorithm (Particle Swarm Optimization) to solve our problem, examining the results obtained for different terrain sizes (from 25m×25m to 100m×100m) and ground users (from 10 to 100). In the most demanding case, we were able to provide VoWiFi service with four distribution drones and five access drones. Our results show that the overall number of UAVs deployed grows with the terrain size (i.e., with users' sparsity) and the number of ground users. © 2022 Vicente Mayor et al.},

note = {cited By 4},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{Mayor20201,

title = {Energy-efficient uavs deployment for qos-guaranteed vowifi service},

author = {V. Mayor and R. Estepa and A. Estepa and G. Madinabeitia},

url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-85089348929&doi=10.3390%2fs20164455&partnerID=40&md5=e3dcfd4e62d8b2180e9fdfe7b936b6c0},

doi = {10.3390/s20164455},

issn = {14248220},

year  = {2020},

date = {2020-01-01},

urldate = {2020-01-01},

journal = {Sensors (Switzerland)},

volume = {20},

number = {16},

pages = {1-32},

publisher = {MDPI AG},

abstract = {This paper formulates a new problem for the optimal placement of Unmanned Aerial Vehicles (UAVs) geared towards wireless coverage provision for Voice over WiFi (VoWiFi) service to a set of ground users confined in an open area. Our objective function is constrained by coverage and by VoIP speech quality and minimizes the ratio between the number of UAVs deployed and energy efficiency in UAVs, hence providing the layout that requires fewer UAVs per hour of service. Solutions provide the number and position of UAVs to be deployed, and are found using well-known heuristic search methods such as genetic algorithms (used for the initial deployment of UAVs), or particle swarm optimization (used for the periodical update of the positions). We examine two communication services: (a) one bidirectional VoWiFi channel per user; (b) single broadcast VoWiFi channel for announcements. For these services, we study the results obtained for an increasing number of users confined in a small area of 100 m2 as well as in a large area of 10,000 m2 . Results show that the drone turnover rate is related to both users’ sparsity and the number of users served by each UAV. For the unicast service, the ratio of UAVs per hour of service tends to increase with user sparsity and the power of radio communication represents 14–16% of the total UAV energy consumption depending on ground user density. In large areas, solutions tend to locate UAVs at higher altitudes seeking increased coverage, which increases energy consumption due to hovering. However, in the VoWiFi broadcast communication service, the traffic is scarce, and solutions are mostly constrained only by coverage. This results in fewer UAVs deployed, less total power consumption (between 20% and 75%), and less sensitivity to the number of served users. © 2020 by the authors. Licensee MDPI, Basel, Switzerland.},

note = {cited By 8},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{Mayor2020589,

title = {Unified call admission control in corporate domains},

author = {V. Mayor and R. Estepa and A. Estepa and G. Madinabeitia},

url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-85076849304&doi=10.1016%2fj.comcom.2019.11.041&partnerID=40&md5=5af7826dafc22674ad6e1d5dd0e20f57},

doi = {10.1016/j.comcom.2019.11.041},

issn = {01403664},

year  = {2020},

date = {2020-01-01},

urldate = {2020-01-01},

journal = {Computer Communications},

volume = {150},

pages = {589-602},

publisher = {Elsevier B.V.},

abstract = {Call Admission Control is a central mechanism for assurance of quality of service in telephony. While CAC is integrated into Public Switched Telephony Network (PSTN), its application to voice over IP in a corporate environment is challenging not only due to the heterogeneity of technologies, but also because of the difficulty of implementation into commercial VoIP terminals or Access Points. We present a novel framework that unifies call admission control for VoIP telephony corporate users despite their access network (i.e., WiFi or Ethernet) under a single corporate management domain. Our Unified CAC (U-CAC) system can be implemented in a VoIP Gateway/Proxy and uses only standard protocols already present in commercial off-the-shelf devices, avoiding the need to modify the firmware of existing APs or VoIP terminals. We define two variants of the decision algorithm: basic and advanced. In the basic mode of operation, the admission of new calls is based on the availability of spare circuits and the impact of the new call in the speech quality of VoWiFi calls in progress. In the advanced mode of operation, the traffic load in affected APs is proactively reduced by reconfiguring ongoing calls before rejecting the new call. Simulation results show that the number of simultaneous VoWiFi calls under guaranteed quality increases with our unified call admission control scheme. When using the advanced mode of operation, the number of simultaneous calls under guaranteed quality can be doubled when compared to the standard mode of operation. © 2019 Elsevier B.V.},

note = {cited By 4},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{Mayor2019,

title = {Deploying a Reliable UAV-Aided Communication Service in Disaster Areas},

author = {V. Mayor and R. Estepa and A. Estepa and G. Madinabeitia},

url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-85065643702&doi=10.1155%2f2019%2f7521513&partnerID=40&md5=415539a365bd0d35ce600b19ff3ce412},

doi = {10.1155/2019/7521513},

issn = {15308669},

year  = {2019},

date = {2019-01-01},

urldate = {2019-01-01},

journal = {Wireless Communications and Mobile Computing},

volume = {2019},

publisher = {Hindawi Limited},

abstract = {When telecommunication infrastructure is damaged by natural disasters, creating a network that can handle voice channels can be vital for search and rescue missions. Unmanned Aerial Vehicles (UAV) equipped with WiFi access points could be rapidly deployed to provide wireless coverage to ground users. This WiFi access network can in turn be used to provide a reliable communication service to be used in search and rescue missions. We formulate a new problem for UAVs optimal deployment which considers not only WiFi coverage but also the mac sublayer (i.e., quality of service). Our goal is to dispatch the minimum number of UAVs for provisioning a WiFi network that enables reliable VoIP communications in disaster scenarios. Among valid solutions, we choose the one that minimizes energy expenditure at the user's WiFi interface card in order to extend ground user's smartphone battery life as much as possible. Solutions are found using well-known heuristics such as K-means clusterization and genetic algorithms. Via numerical results, we show that the IEEE 802.11 standard revision has a decisive impact on the number of UAVs required to cover large areas, and that the user's average energy expenditure (attributable to communications) can be reduced by limiting the maximum altitude for drones or by increasing the VoIP speech quality. © 2019 Vicente Mayor et al.},

note = {cited By 25},

keywords = {},

pubstate = {published},

tppubtype = {article}

}